CVE-2016-5258

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-08-05 · updated 2026-06-17
Weakness: CWE-416

Description

Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.

Affected products

Mozilla Firefox: through 47.0.1; 45.1.0, 45.1.1, 45.2.0, 45.3.0
Oracle Corporation Oracle Linux: 5.0, 6, 7

References

http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00029.html
http://rhn.redhat.com/errata/RHSA-2016-1551.html
http://www.debian.org/security/2016/dsa-3640
http://www.mozilla.org/security/announce/2016/mfsa2016-72.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html
http://www.securityfocus.com/bid/92258
http://www.securitytracker.com/id/1036508
http://www.ubuntu.com/usn/USN-3044-1
https://bugzilla.mozilla.org/show_bug.cgi?id=1279146
https://security.gentoo.org/glsa/201701-15
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00004.html

Get alerted when CVE-2016-5258 or the next vulnerability affects your stack